Zotob Worm strikes CNN, ABC, other news orgs (no link)

[AlGore-08.com]

Heard on CNN's Wolf-Blitzer-a-thon, no links yet.

Article on the Zotob Worm:

http://www.entmag.com/news/article.asp?EditorialsID=6864

[Janice325]

1. I'm wondering how much this will effect those of us on the internet.

Like DU, DailyKos, things relating to Cindy, etc.
That would be an effective way to shut many of us down.
Oh, great. I'm listening to CNN and a woman just said the FBI isn't aware of anything happening in the last 24 hours. Whoopie doo.

[AlGore-08.com]

2. Depends on the servers - - Zotob strikes Windows 2000, not later versions

So if the site is run off a server using Windows 2000, it is vulnerable unless the system administrators use a patch Microsoft issued Friday - - if the patch part is wrong, please correct me, DU computer geek gods... :)

[bpilgrim]

32. MS: How to Recover from Infection ---------- ------------ > LINK

http://www.microsoft.com/security/encyclopedia/details.aspx?name=Worm:Win32/Zotob.A#Recovery

Symantec offers a free detection/deletion tool that takes care of the Zotob.a and Zotob.b variants. It can be downloaded from the vendor's Web site.
http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.removal.tool.html

peace

[JanusAscending]

3. WORM~~~

I was just watching CNN, and now ABC computers using windows 2000 are infected. They say it's not affecting emergency networks YET! Could this have something to do with silencing cyberspace because of the "WAR GAMES" coming up tomorrow? :nuke:

[Old Vet]

4. Affects 2000 And XP Platforms per Cnn

[JanusAscending]

7. Hey, Old Vet!!

I'm old too, so what you said means "nada" to me. I'm a "little computer illiterate!!! I can work my way around well enough tho', and am thankful that I have windows 98 !!! So.......what does this mean?:shrug:

[ChairmanAgnostic]

6. ! ! ! ! ! ! ! ! ! !

Thanks for the reminder, just as I was relaxing.
But, damn. it makes sense.

lull everyone into a stupor, lower the warning color alert level, then concoct something absolutely vile.

[JanusAscending]

16. Deja Vu!!!!!

I don't know if any of you on line now read my post the other day about my ESP, or gift of "discernment" Damn it!! I just know things sometimes before they happen. Well I've been feeling strongly lately that "something BIG" was getting ready to happen. I've warned all my kids, that I wasn't sure yet whether it was going to be good or bad, but the feeling I'm getting right this very minute is DUCK AND COVER!!!! I hate to Alarm anyone, but when I read the post #11 from Tahiti nut, I experienced Deja Vu, like this has all happened before! So whether or not you doubt my sanity, please be very diligent!! If I'm wrong, you can all cuss me out later, but I'm usually right.:grouphug:

[ChairmanAgnostic]

31. oh pleeze oh pleeze oh pleeze be wrong.

pretty please, with cane sugar on top.

[Mistress Quickly]

12. There's war games tomorrow?

I am so out of the loop.

[katty]

34. yup, war games tomorrow-closed to media and public

[tridim]

5. Someone check the AAR streaming servers.

[Old Vet]

8. This is NOT zotab, This is NEW worm

[KTM]

36. Regardless

Zotob and Esbot are both explioting the same flaw.. patch against it, follow the instructions from SARC to see if you have it (and disable it if you do) and you'll be fine.

[Karla Marx]

20. I couldn't get AAR to stream at all after 3 pm...

...thought it was my shitty PC at work. Tomorrow I bring a radio.
CNN is doing a story on the worm right now. Navel-gazing, anyone?

[Enraged_Ape]

9. Zotob knocked at my firewall today

But I guess since I have the latest McAfee personal firewall and Win98 SE, it decided to move on.

[JanusAscending]

10. Same here!!

Thank God I just installed the newest from McAffe as well!

[Enraged_Ape]

23. McAfee's great

I didn't realize how many "unwelcome visitors" I got until I installed the McAfee firewall! Almost every day someone comes knocking at my door. Pretty scary.

[VegasWolf]

25. Right, I use the Norton Firewall, I would never use the little Windows

firewall.

[TahitiNut]

13. I've been getting a LOT of UDP probes on ports 1026 and 1027

Only a few of this kind ...
2005/08/16 6:08:42 PM GMT -0400: 3Com EtherLink 10..[0002][No
matching rule] Blocking incoming TCP: src=69.14.159.117,
dst=69.14.***.***, sport=1233, dport=445.

Port 445 is apparently its propagation vector.

[VegasWolf]

22. On 1026-1030 ....

That's just the FBI. Teasing.

:spank:
:toast:

[TahitiNut]

11. It's another one that exploits buffer overflow. (sigh)

As a systems programmer (operating systems and systems software) of over 35 years, I can't even begin to express my disgust for the state of the software "art." :puke:

[VegasWolf]

14. My XP just updated itself and all is fine.... Wait, I'm ggettiinngg

ffuunnyy ggrreeeennn llllighhhtttss, awwwwwww nnnoooooooooooo!

O8)

[Old Vet]

15. Talking to friends in Germany and its a real pain in the ass........

Seems if your puter gets affected you have to download patch on cd and boot up, What a Drag. I want what Vegaswolf is smoking!:toast:

[htuttle]

17. Hey, there's no ticker at the bottom of the screen!

Not on CNN nor CNN Headline News.

Guess the virus ate it.

:shrug:

[ElsewheresDaughter]

19. is it effecting just the cable news networks? faux news has the tickertape

crawling across the bottom but niether CNN nor MSNBC does :shrug:

[Career Prole]

18. Just got this "Breaking News" e-mail from CNN

"A worm shut down computers running Windows 2000 software across the United States."

That was it...

[stepnw1f]

21. Gotta Love my Mac OSX

Then again I do have to worry about my PC at work.

[Applepie]

27. I'm with you

Mac for me too

[bpilgrim]

28. MS05-039 Worm in the Wild - Slashdot

http://it.slashdot.org/it/05/08/14/147245.shtml?tid=220&tid=172

peace

[Brundle_Fly]

30. I am a solo mac in a

frenzy of PC's here at the office. I am certainly not feeling the dread the others here are.

fyi Tiger Users

Now available via Software Update:
Security Update 2005-007 delivers a number of security enhancements and is recommended for all Macintosh users. This update includes the following components:

AppKit
BlueTooth
CoreFoundation
cups
Directory Services
HIToolBox
Kerberos
loginwindow
Mail
OpenSSL
QuartzComposerScreenSaver
Security Interface
Safari
X11
zlib

For detailed information on this Update, please visit this website: http://www.info.apple.com/kbnum/n61798

[boredofeducation]

37. Gotta love my Commodore 64

The best darn platform ever! Virus Free! I love my commodore!

[DeepModem Mom]

24. Think CNN's now saying it may not be Zotob. nt

[nadinbrzezinski]

26. folks call this a very sneaky suspicion but this

has all the elements of a successful cyber attack

WOOHOO... who said DHS was gonna work on this?

[Mr.Green93]

29. Wasn't there an outbreak before 9/11?

I'm going to get some duct tape.

[VegasWolf]

33. Good news!! All of the Porn servers are up and well! nt

[KTM]

35. Stop the panic & FUD !!

I've got a stylish collection of tin hats, but I'm not donning one for this.

It's just a worm. Actually, several variations of the same one, which is usually what happens when someone exploits a flaw that was just recently announced - it's almost always followed by rapid variants. In this case, the flaw and patch were just issued on the 8th & 9th, and the riff-raff beat most users to the punch. This was predicted by the experts the day the flaw was announced.


Reliable info on the worm, it's variants, Norton/Symantec virus definitinions, how to tell if you have it, and later version removal tools at Symantec (SARC)

Patch your PC against this exploit: (Win2K) and (WinXP)

Does not effect Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME).

More info on vulnerability at Symantec and Microsoft

Removal tool from Symantec for first two variants of Zotob here.

None available yet for Esbot.